> Failures follow consistent patterns: agents let a plausible in-environment request override the standing policy

I prefer this behavior in a lot of situations. A plausible request can also be a genuine one.

Alignment at the grain of each tool response is way more effective than a static system prompt. I try to keep mine under 500 tokens. Why bother fighting recency bias? It's pretty much what you want most of the time.